Submit a Pull Request Report a Bug

openssl_spki_verify

(PHP 5 >= 5.6.0, PHP 7, PHP 8)

openssl_spki_verify — 验证签名公钥和 challenge

说明

openssl_spki_verify(string $spki): bool

验证提供的签名公钥和 challenge。

参数

spki: 期望有效的签名公钥和 challenge。

返回值

成功时返回 true，或者在失败时返回 false。

错误／异常

如果传递给 digest_algo 的参数不是可用的参数，将会抛出 E_WARNING 级别的错误。

示例

示例 #1 openssl_spki_verify() 示例

验证现有签名公钥和 challenge

<?php
$pkey = openssl_pkey_new('secret password');
$spkac = openssl_spki_new($pkey, 'challenge string');

if (openssl_spki_verify(preg_replace('/SPKAC=/', '', $spkac))) {
    echo $spkac;
} else {
    echo "SPKAC validation failed";
}
?>

示例 #2 openssl_spki_verify() 来自 <keygen> 的示例

通过 <keygen> 元素验证现有签名公钥和 challenge

<?php
if (openssl_spki_verify(preg_replace('/SPKAC=/', '', $_POST['spkac']))) {
    echo $spkac;
} else {
    echo "SPKAC validation failed";
}
?>
<keygen name="spkac" challenge="challenge string" keytype="RSA">

参见

openssl_spki_new() - 生成新的签名公钥和 challenge
openssl_spki_export_challenge() - 导出与签名公钥和 challenge 相关的 challenge
openssl_spki_export() - 通过签名公钥和 challenge 导出一个可用的 PEM 格式的公钥
openssl_get_md_methods() - 获取可用的摘要算法
openssl_csr_new() - 生成一个 CSR
openssl_csr_sign() - 用另一个证书签署 CSR（或者本身）并且生成一个证书

＋add a note

User Contributed Notes 2 notes

down

carloshlfzanon at gmail dot com ¶

6 years ago

This openssl_spki_* funcs are very usefull to use with <keygen/> tag in html5.

Example:

<?php
session_start();

// form submitted... (?)
if(isset($_POST['security']))
{
    // If true, the send from <keygen/> is valid and you can
    // test the challenge too
    if(openssl_spki_verify($_POST['security']))
    {
        // Gets challenge string
        $challenge = openssl_spki_export_challenge($_POST['security']);

        // If true... you are not trying to trick it.
        // If user open 2 windows to prevent data lost from a "mistake" or him just press "back" button
        //  and re-send last data... you can handle it using something like it.
        if($challenge == $_SESSION['lastForm'])
        {
            echo 'Ok, this one is valid.', '<br><br>';
        }
        else
        {
            echo 'Nice try... nice try...', '<br><br>'; 
        }
    }

}

// If you open two window, the challenge won't match!
$_SESSION['lastForm'] = hash('md5', microtime(true));

?>

<!DOCTYPE html>
<html>
<body>

<form action="/index.php" method="post">
  Encryption: <keygen name="security" keytype="rsa" challenge="<?php echo $_SESSION['lastForm']; ?>"/>
  <input type="submit">
</form>

</body>
</html>

down

neat at neato dot com ¶

3 years ago

The challenge is not how to very a "trick". It is used as a partial non-repudiation method.

The idea was the challenge could be extracted from the base64 encoded ASN.1 PKCS#1 bits provided from the 'keygen' element.

The SPKAC is a form of CSR which if the right about of information such as the commonName, emailAddress, countryName, stateOrProvinceName, localityName et al., a signed x509 could generated and provided to the requestor.

This would then be installed in the browser and if the webserver was configured to accept client x509 certificates, it would be used in lieu of a password for authentication.

A recommendation was to use the 'challenge' as a form of non-repudiation in the event someone else was on your keyboard. If the application required it could prompt you for the challenge and compare it to a hashed version it stored upon the initial SPKAC process.

Hope that helps clear it up.

＋add a note